GDPR for driving schools: what to log, what not

A driving school holds more personal data than most small businesses: names, addresses, dates of birth, licence numbers, phone numbers for parents, sometimes health notes. UK GDPR applies to all of it, including for a sole-trader instructor with twenty learners.

The good news is that what it asks of a small school is short. This covers the parts that apply, what to keep, what to leave out, and the requests you are likely to get. It is not legal advice; the Information Commissioner’s Office (ICO) is the authority, and its guidance for small businesses is written to be read.

Step 1: check whether you need to pay the ICO fee

Organisations that use personal information, sole traders included, have to pay the ICO a data protection fee unless they are exempt. Most driving schools will need to pay it. The fee is set by size, the smallest tier is a modest annual amount, and the ICO’s page has a short self-assessment that tells you whether you are exempt and which tier you are in.

Once you have paid, you get a registration number. Put it in your privacy notice.

Step 2: know who is the controller

Two roles matter:

The controller decides why and how personal data is used.
A processor handles personal data on the controller’s behalf and on its instructions.

For a school on Passdesk, the school is the controller for its learners’ records: it decides what to collect and why. Passdesk is the processor, and the processor terms are part of Passdesk’s terms of service. Passdesk in turn uses sub-processors, such as its email provider, and lists them on the security page.

This matters when a learner uses one of their rights. The school answers the request. It can ask its software provider for help, but the duty sits with the controller.

Step 3: pick a lawful basis for each kind of data

Every use of personal data needs a lawful basis. For a driving school the answers are short:

Contract for everything needed to teach the learner: name, contact details, lesson history, package balance, progress notes.
Legal obligation for the records the law makes you keep, mainly your financial records for HMRC.
Legitimate interests for things like a feedback email after a learner passes. You should be able to say why your interest does not override the learner’s.
Consent for marketing, and for extras such as a pass photo on social media. Keep a record of when consent was given and what for.

If you cannot name a basis for a piece of data, you probably do not need it.

What to keep

Learner records. Name, contact details, date of birth, licence number, instructor, lesson history and package balance.
Payment records. What was paid, when and for what. If you take cards through a payment provider, the card details stay with the provider and never reach your records.
Lesson and progress records. Date, length, instructor, the skills covered and your notes.
Consent records. When a learner accepted your privacy notice, and any marketing or photo consent.
A record of changes. Who changed a learner’s record, and when. If there is ever a dispute about a balance or a cancelled lesson, this is what settles it.

HMRC expects a self-employed instructor to keep business records for at least 5 years after the 31 January submission deadline of the tax year they relate to. That is the floor for the financial side.

What to leave out

Card numbers and security codes. Holding card data puts your school inside the card industry’s security rules (PCI DSS). Let a payment provider hold it.
Medical detail beyond what the lesson needs. Health information is special category data. Record “needs a break every 40 minutes”, not the diagnosis behind it, and only with the learner’s explicit agreement.
Other special category data. Religion, politics, sexual orientation and the like have no place in a learner record.
Screenshots of WhatsApp chats. They carry more of the conversation than you need. If a message matters, note the fact it records.
Photos you have not been given permission to use. A pass photo needs written consent, and for an under-18 learner, the parent’s too. Under-18 learners covers the rest of what changes for children’s data.

The requests you will get

UK GDPR gives people eight rights. A driving school mostly sees four.

Access. A learner asks what you hold on them. You have one month to respond, and in most cases you cannot charge.
Rectification. A learner tells you their address is wrong. Fix it.
Erasure. A learner asks you to delete their data. You can keep what the law requires, such as financial records for HMRC, and delete the rest, starting with contact details and notes you no longer need.
Portability. A learner asks for their records to take to another school. A clean export of their details and lesson history covers it.

If any of these would take you more than an afternoon, the records are in too many places.

When something goes wrong

A personal data breach can be as ordinary as a lost phone, a hacked email account or a group email sent with everyone’s address visible. If the breach is likely to put people at risk, you have 72 hours from becoming aware of it to report it to the ICO. If the risk to them is high, you also tell the people affected.

Write a one-page plan now:

Who decides whether something is a breach. For most schools, that is you.
Who you contact: the ICO, your insurer, your software providers.
What you tell the people affected.
What you change so it does not happen again.

A short checklist

Pay the ICO fee, or confirm you are exempt.
Write a privacy notice that describes the data you hold, not a template’s.
Keep a record of who changed what in your learner records.
Do not store what you do not need.
Be ready to answer an access request within a month.

Where Passdesk fits

On Passdesk, school owners have an audit log of changes to their school’s records, learners can download their own data from their account, and Passdesk can produce the same file for a school that is answering an access request. Card details stay with Stripe, and the processor terms come with the subscription.